# Secure Commit

> Pre-commit safety check and passive guardrail against sensitive files. Invoke with /secure-commit to scan staged files or audit git history. Install globally to block leaks automatically before every commit.

- Skill: `tyecode/secure-commit` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add tyecode/secure-commit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tyecode/secure-commit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tyecode (https://skillmd.com/u/tyecode)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tyecode/secure-commit

---


# Skill: secure-commit

## When to Use This Skill

**Explicit invocation** — run `/secure-commit` to scan what's staged right now before committing, or audit past commits for leaked secrets.

**Passive guardrail** — install globally and it applies automatically before every `git add` or `git commit`.

## Invocation Modes

```
/secure-commit              → staged files only (default)
/secure-commit commits      → staged + last 10 commits
/secure-commit commits 50   → staged + last N commits
/secure-commit history      → full local git history
/secure-commit remote       → what's currently tracked on GitHub remote
/secure-commit all          → everything above
```

The bundled script handles all local scans. Remote scanning is done by the agent directly using git and gh commands.

```bash
bash <skill-dir>/scripts/scan.sh [staged|commits|history|all] [depth]
```

## Git Hook Mode (No Agent Required)

Install as a pre-commit hook so it blocks secret leaks on every `git commit`, even without an AI agent:

```bash
bash <skill-dir>/scripts/install-hook.sh
```

This copies the scan script to `.git/hooks/secure-commit-scan.sh` and installs a pre-commit hook that runs it automatically. If sensitive data is found, the commit is blocked with a clear error message.

**Uninstall:**
```bash
bash <skill-dir>/scripts/uninstall-hook.sh
```

**How it works:**
- Runs on every `git commit` before the commit is created
- Scans only staged files (fast, ~instant)
- Exits non-zero if secrets found → commit blocked
- Existing pre-commit hooks are backed up automatically
- Works with any git client (CLI, VS Code, etc.)

**Test it:**
```bash
# Create a .env file (blocked by filename pattern)
touch .env
git add .env
git commit -m "test"  # should be blocked

# Clean up
git reset HEAD .env && rm .env
```

### All scan (`/secure-commit all`)

Run each scan in sequence and collect all findings before fixing anything:

1. **Staged** — `git diff --cached --name-only`
2. **Full local history** — `git log --all --full-history --name-only --format="%H %s"`
3. **Remote** — fetch and inspect all remote branches (see below)

After collecting findings from all three, report a summary grouped by category, then apply the appropriate fix protocol for each finding.

### Remote scan (`/secure-commit remote`)

Check what sensitive files are currently tracked on the GitHub remote:

```bash
git fetch origin
git ls-tree -r --name-only origin/<default-branch>
```

Scan the output against all blocked filename patterns. If anything matches, report it with the full path and which remote branch it was found on.

Also check all remote branches, not just the default:

```bash
git branch -r --format='%(refname:short)'
```

For each branch, run `git ls-tree -r --name-only <branch>` and scan the results.

## Blocked File Patterns

Never stage or commit files matching these patterns, regardless of what the user asks:

**Environment files**
- `.env`, `.env.*`, `*.env`

**Secrets and credentials**
- `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.cer`, `*.crt`
- `id_rsa`, `id_ed25519`, `id_ecdsa`, `id_dsa`
- `*.keystore`, `*.jks`
- `credentials.json`, `credentials.yml`, `credentials.yaml`
- `secrets.json`, `secrets.yml`, `secrets.yaml`

**Cloud and service configs**
- `.aws/credentials`, `aws_credentials`
- `gcloud/application_default_credentials.json`
- `serviceAccountKey.json`, `service-account*.json`
- `firebase-adminsdk*.json`
- `*.tfvars`

**Auth tokens and API keys**
- `.npmrc` (with auth token), `.pypirc`, `.netrc`, `.htpasswd`

**Database**
- `*.sqlite`, `*.sqlite3`, `*.db` (unless clearly test fixtures)
- `pg_hba.conf`

## Sensitive Content Patterns

Also scan file content for:
- `password=`, `secret=`, `api_key=`, `token=`
- `BEGIN RSA/EC/OPENSSH PRIVATE KEY`
- AWS keys (`AKIA...`), GitHub PATs (`ghp_...`), Slack tokens (`xox*`), OpenAI keys (`sk-...`)
- Database URLs with embedded credentials (`postgres://user:pass@...`)

## Hard Rules (Passive Mode)

**CRITICAL: Never commit sensitive files, even when explicitly asked.**

If the user says "commit everything" or uses `git add .`:
1. Run `git status` first
2. Scan the file list against the blocked patterns
3. Stop and report any matches before staging
4. Remove those files from the staging command

If a sensitive file is already staged:
```bash
git reset HEAD <sensitive-file>
```

## .gitignore Enforcement

When a project lacks `.gitignore` entries for sensitive files, add them before the first commit:

```
.env
.env.*
!.env.example
!.env.template
*.pem
*.key
*.p12
credentials.json
serviceAccountKey.json
```

## Fix Protocol

See [FIXES.md](FIXES.md) for the full incident response and fix protocol.

## Safe Alternatives

```
.env.example     ← commit this (placeholder values only)
.env             ← never commit (real values, gitignored)
```

For sharing secrets with the team: use a secrets manager (AWS Secrets Manager, Vault, 1Password) or CI/CD environment variables (GitHub Actions secrets, Vercel env vars).